One directive, twenty-seven laws. Pick yours.
Directive (EU) 2019/1937 set the floor. Each member state then wrote its own act, named its own authority, set its own penalties and decided for itself whether anonymous reports must be accepted. This is the part most vendors skip.
The floor the directive sets
50 workers
Private employers at or above fifty workers must establish internal reporting channels and procedures. Some sectors, including financial services and anti money laundering, are caught with no threshold at all.
Seven days and three months
Acknowledge receipt within seven days, designate an impartial person or department to follow up, and give the reporting person feedback within three months.
A third party may run it
Article 8(5) allows the channel to be operated externally by a provider. That is exactly what we do, under an Article 28 GDPR processing agreement.
Fifty to two hundred and forty-nine may share
Article 8(6) lets employers in that band share resources for receiving and investigating reports. Useful for a group of small entities under one owner.
Protection is wider than employees
Article 4 covers the self-employed, shareholders, board members, volunteers, trainees, people working under the supervision of contractors and suppliers, former workers and job applicants.
Retaliation is prohibited
Dismissal, demotion, blacklisting and similar measures against someone who reported are unlawful, and the burden of proof shifts to the employer.
Not sure which entity is caught?
Send us your structure, headcount by entity and country. We will tell you which of them owes a channel and which can share one.